j3d1/tinc
1
0
Fork 0
Code Issues 1 Pull requests Releases Wiki Activity

Honour umask, let temporary key files inherit original's permissions.

Browse source 
During the init command, tinc changed the umask to 077 when writing the public
and private key files, to prevent the temporary copies from being world
readable. However, subsequently created files would therefore also be
unreadable for others. Now we don't change the umask anymore, therefore
allowing the user to choose whether the files are world readable or not by
setting the umask as desired. The private key files are still made unreadable
for others of course. Temporary files now inherit the permissions of the
original, and the tinc-up script's permissions now also honour the umask.
This commit is contained in:
Guus Sliepen 2013-07-22 22:58:13 +02:00
parent ae85a02030
commit 5fca595b80
1 changed files with 13 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/tincctl.c
View file

@ -227,6 +227,16 @@ static void disable_old_keys(const char *filename, const char *what) {
w = fopen(tmpfile, "w");
#ifdef HAVE_FCHMOD
/* Let the temporary file have the same permissions as the original. */
if(w) {
struct stat st = {.st_mode = 0600};
fstat(fileno(r), &st);
fchmod(fileno(w), st.st_mode);
}
#endif
while(fgets(buf, sizeof buf, r)) {
if(!block && !strncmp(buf, "-----BEGIN ", 11)) {
if((strstr(buf, " EC ") && strstr(what, "ECDSA")) || (strstr(buf, " RSA ") && strstr(what, "RSA"))) {
@ -324,8 +334,6 @@ static FILE *ask_and_open(const char *filename, const char *what, const char *mo
filename = buf2;
}
umask(0077); /* Disallow everything for group and other */
disable_old_keys(filename, what);
/* Open it first to keep the inode busy */
@ -1702,7 +1710,9 @@ static int cmd_init(int argc, char *argv[]) {
fprintf(stderr, "Could not create file %s: %s\n", filename, strerror(errno));
return 1;
}
fchmod(fileno(f), 0755);
mode_t mask = umask(0);
umask(mask);
fchmod(fileno(f), 0755 & ~mask);
fprintf(f, "#!/bin/sh\n\necho 'Unconfigured tinc-up script, please edit!'\n\n#ifconfig $INTERFACE <your vpn IP address> netmask <netmask of whole VPN>\n");
fclose(f);
}